Bangladesh Data Protection & Privacy Regulation

Lawful Processing & Special Data

The Personal Data Protection Act, 2026 is reported to require explicit and informed consent from individuals before their personal data may be collected or processed, placing Bangladesh's framework on a consent-centred footing comparable in structure to other recent Asian data-protection statutes. Government functions are reported to carry exemptions from this consent requirement on grounds including national security, public order, and crime prevention, a carve-out pattern consistent with the broader institutional picture of an Authority that is better positioned to act against private actors than against the state's own data processing.

These findings are understood at the level of general topic rather than confirmed against a specific numbered provision of the Act, so the precise contours of the consent requirement, including whether distinct categories such as special or sensitive personal data carry heightened consent or safeguarding conditions, have not been independently established. The classification of personal data into tiers, addressed separately below in the context of surveillance governance, is relevant background to how the consent regime may ultimately be applied across data categories.

Lawful Processing & Special Data

Processing under the Personal Data Protection Act, 2026 is understood to rest on a consent-based model: the Act is reported to require that processing of personal data generally be based on informed consent, with specific exemptions carved out for vital interests and national security. Consent itself is understood to carry defined quality thresholds - it must be free, specific, unambiguous and easily revocable - rather than being satisfied by mere notice or passive acceptance. The exact statutory pinpoint for these consent-quality requirements has not been located in primary text; the account rests on law-firm and compliance commentary rather than the gazetted Act itself. Separately, the Act is reported to specify tiered categories of data processing, including a high-risk tier, though the full classification scheme and its consequences for processing conditions have not been confirmed in detail.

Outlook

A consent-based model with defined quality thresholds for consent itself represents a more structured lawful-basis regime than a bare notice-and-consent approach, but the absence of primary text means the precise scope of the vital-interests and national-security exemptions, and the operative detail of the tiered-processing classification, cannot yet be stated with confidence.

Lawful Processing & Special Data

Section 5(3) of the Personal Data Protection Act 2026 is reported to permit the processing of personal data without explicit consent only under a narrow set of exceptions: where processing is necessary for the performance of a contract, for the defence of legal rights, for the protection of vital interests, or where the data subject has voluntarily published the information in question. This is a relatively tight consent gate by the standards of comparable omnibus statutes, placing the burden on controllers to identify a specific narrow exception rather than relying on a broad legitimate-interest-style basis.

Set against that narrow consent gate, Section 24 is reported to create a considerably broader exemption from the Act's consent and notice duties. That exemption is understood to cover crime-fighting, investigations, regulatory work, statistics, and other government functions, and to be triggerable on national-security, public-order, or crime-prevention grounds. Notably, the available commentary does not identify an explicit judicial-authorisation requirement attached to this exemption, meaning its invocation is not reported to require independent judicial sign-off. This exemption also functions as a state-surveillance carve-out, a dual role that is addressed further under algorithmic and surveillance governance below.

The juxtaposition of a narrow private-sector consent gate under Section 5(3) with a broad, judicially-unconstrained government exemption under Section 24 is a structural asymmetry worth noting: ordinary data fiduciaries face a restrictive consent regime, while government bodies invoking the listed grounds face comparatively few procedural constraints under the statute as currently reported.

Outlook

Whether the government exercises the Section 24 exemption in practice, and whether any judicial or administrative check on its use develops in guidance or case law, are the principal items to watch. Confirmation of the exact wording of both Section 5(3) and Section 24 against the gazetted text would also sharpen the present account, which currently rests on secondary legal commentary.

Lawful Processing & Special Data

The Personal Data Protection Act, 2026 establishes a consent-based lawful-processing regime in which consent must be freely given, specific, unambiguous and revocable. Controllers seeking consent are required to inform data subjects of the purpose of processing, the retention period, any third-party transfers, and the procedure for withdrawing consent. This consent architecture is broadly consistent with the structure found in comparable international consent-based regimes, requiring affirmative, informed and revocable agreement rather than inferred or bundled consent.

The specific treatment of special categories of data, such as health, biometric or religious data, under the Act has not been confirmed in the sourcing available this cycle, and no claim regarding heightened special-category processing conditions can be made beyond the general consent framework described above. This is a gap in the current evidence base rather than a finding that no special-category regime exists.

Outlook

Further confirmation of how the consent framework interacts with any special-category data provisions, and of the specific withdrawal mechanism contemplated by the Act, would strengthen the current probable-confidence characterisation of this module's compliance requirements.

Lawful Processing & Special Data

The Personal Data Protection Act, 2026 establishes consent as the general lawful basis for processing personal data in Bangladesh, with vital-interest grounds and national-security, public-order and public-interest exemptions reported alongside it. This structure is a probable reading of the Act based on secondary legal commentary rather than confirmed primary text, but it establishes a recognisable architecture: a consent-first default with broad carve-outs available to the State.

Alongside the general lawful-basis provision, the Act is reported to require explicit, informed consent specifically before the collection, storage, transfer or use of personal data. This formulation suggests consent is not a one-time gate at collection but is understood to attach to each of these discrete processing activities, which would be a relatively stringent consent architecture if confirmed by primary text.

The breadth of the national-security and public-interest exemptions is the feature of this module most likely to matter in practice. The same exemption language recurs in the Act's treatment of the National Data Governance Authority itself, where the government's power to direct the Authority is grounded in the same national-security and public-order language. Read together, these provisions suggest the exemptions are not confined to specific processing scenarios but form a general override available to the State across the Act's operation. This reading is probable rather than confirmed, given that no primary gazette text was retrieved this cycle.

Outlook

The operative scope of the national-security and public-interest exemptions — how narrowly or broadly they will be applied in practice — is the key unresolved question for this module. Primary text confirmation of the consent-threshold language, and any implementing rules clarifying the boundaries of the exemptions, would be the clearest signal of how this module develops from here.

Controller/Processor Duties

Whether the Personal Data Protection Act, 2026 imposes a mandatory personal-data breach-notification duty on controllers is disputed between sources of comparable standing: one commentary asserts no such mandatory duty exists, while another describes mandatory breach notification as a requirement of the Act. This disagreement has not been resolved against primary text and should be read as an open question rather than a settled feature of the regime.

A clearer picture exists on data retention and localisation duties, following the amending ordinance reported to have taken effect on 5 February 2026. That amendment is understood to narrow the data-localisation mandate so that it applies only to Critical Information Infrastructure and to restricted or confidential personal data, rather than to the broader population of personal data originally contemplated. The same amendment is reported to have replaced imprisonment with monetary fines only, for managing directors found in violation of data-subject rights provisions under section 48 of the Act. Taken together, these amendments suggest a legislature recalibrating the controller-facing burden of the regime toward a narrower, more commercially workable localisation duty and a less severe individual-liability regime for corporate officers, even as the breach-notification question remains unsettled.

Outlook

Resolution of the breach-notification dispute, and confirmation of the precise retention and localisation rules against primary legislative text, are the principal open items bearing on controller and processor compliance exposure in Bangladesh going forward.

Controller/Processor Duties

Organisations subject to the Personal Data Protection Act, 2026 are understood to face a set of organisational duties, including the appointment of a Chief Data Officer and the implementation of data protection policies. The Act is also reported to specify tiered data processing categories, including a high-risk tier, and to impose some duty in the event of a data breach, although a mandatory breach-notification duty running specifically to affected individuals has not been confirmed - one commentary notes the apparent absence of such a duty, naming the Prime Minister's Office as the enforcing authority in that context, which sits uneasily alongside the NDGA's reported enforcement role and has not been reconciled. Separately, the Personal Data Protection (Amendment) Ordinance, 2026 (Ordinance No. 23 of 2026), made in February 2026, replaced the threat of imprisonment for managing directors under section 48 of the original Ordinance for violations of data-subject rights with monetary fines only, altering the personal-liability exposure of corporate officers under the regime without clarifying what the revised fine tiers are.

Outlook

The duties picture is substantive but uneven: organisational obligations like appointing a Chief Data Officer are reported with reasonable consistency, while the breach-notification duty and the question of which authority actually enforces it remain unresolved between competing secondary accounts. The February 2026 shift from imprisonment to fines for managing directors is the clearest and best-evidenced change in this area, moving corporate compliance risk from a criminal to a monetary register.

Controller/Processor Duties

Section 23 of the Personal Data Protection Act 2026 is reported to require organisations designated as Significant Data Controllers to appoint a Chief Data Officer, who would serve as the primary point of contact with the National Data Management Authority. However, the available commentary indicates that activation of this duty is delayed pending further government notification, meaning Significant Data Controllers are not yet required to have a Chief Data Officer in place as a matter of current practical enforcement, even though the statutory duty exists on the books. The fuller complaints, investigation and administrative-penalty machinery under Sections 31-35 is reported to be expected to become operative on or around 13 May 2027, a date that should be read as the best current estimate from secondary legal-research commentary rather than a confirmed gazetted commencement date.

On processor arrangements, a mirror of the underlying Ordinance text confirms that a data controller may, under a valid contract, appoint or otherwise engage a processor to process personal data on its behalf, for example for activities such as the supply of goods. This is a standard controller-processor contractual gateway and is sourced directly to a copy of the Ordinance text rather than secondary commentary, giving it comparatively higher confidence than other provisions discussed in this module.

On security obligations, a single Tier-3 secondary source reports that security failures attract administrative fines of up to BDT 25 lakh under Section 33 of the Ordinance or Act. Because this figure rests on only one secondary source, it should be treated with caution pending confirmation against the gazetted text or a second independent source.

Outlook

The most significant date to track is the activation, expected on or around 13 May 2027, of the Chief Data Officer appointment duty and the Sections 31-35 complaints and penalty machinery; until that date, Section 23 operates as an enacted-but-not-yet-fully-effective duty. Confirmation of the BDT 25 lakh security-failure fine figure against a second source or the gazette would also strengthen the present account.

Controller/Processor Duties

The Personal Data Protection Act, 2026 imposes a breach-notification duty on controllers that runs to the National Data Management Authority, not to affected individuals, triggered where a breach is likely to cause what the Act terms "significant damage" to a data subject. The specific timeframe and manner in which this notification must be made are left to future regulations that have not yet been located, meaning that while the existence of the duty is confirmed, its operational detail is not yet settled.

This structure, where notification runs only to the regulator and not to the individual whose data was affected, is a feature that independent commentary has identified as a structural gap relative to data-protection frameworks that impose a parallel individual-notification duty for breaches above a certain severity threshold. The absence of a citizen-facing notification requirement means that affected individuals' awareness of a breach depends entirely on whether and how the National Data Management Authority chooses to make such breaches public, a practice not yet documented.

Beyond breach notification, broader controller and processor obligations (such as data-protection-by-design requirements, processor-contract minimum terms, or record-keeping obligations) have not been confirmed in the sourcing available this cycle and are not characterised here.

Outlook

The regulations expected to define the "significant damage" threshold and the associated notification timeframe are the key open item for this module. Their eventual content will materially determine how burdensome and how protective the breach-notification regime proves to be in practice.

Controller/Processor Duties

The Personal Data Protection Act, 2026 establishes a set of controller and processor obligations, reported to include audits, data-protection plans, security safeguards and retention controls. Organisations that coordinate with the National Data Governance Authority are also reported to face Chief Data Officer obligations, a designation that appears functionally analogous to a data-protection-officer requirement found in other comprehensive regimes, though the exact trigger thresholds for when the CDO obligation applies are not confirmed from primary text.

Mandatory breach notification by controllers, described in the Act as data fiduciaries, is also reported this cycle. However, the risk threshold that triggers the notification duty, and the notification deadline itself, are not confirmed from the secondary commentary available, which limits how precisely this obligation can currently be described. This is a gap in retrieved primary text rather than a gap in the law itself, and should be read as such.

Separately, the Personal Data Protection (Amendment) Ordinance, 2026 replaced criminal liability, including imprisonment, for managing directors under section 48 of the prior ordinance framework with monetary fines only, effective 5 February 2026. While this amendment is substantively an enforcement-and-penalties change, it bears directly on controller/processor duties because it materially changes the personal-liability calculus facing the individuals who are typically tasked with ensuring an organisation's compliance with audit, data-protection-plan and breach-notification duties.

Outlook

Confirmation of the breach-notification risk threshold and deadline, and of the precise CDO-obligation trigger, are the clearest gaps to be closed by primary-text retrieval. Given the recency of the move from criminal to monetary liability for managing directors, organisations operating in Bangladesh are likely to be watching for further amendment activity, as the regime has already been revised multiple times within less than a year.

Cross-Border & Adequacy

Bangladesh's data-localisation position has moved toward a narrower formulation following the amending ordinance reported to have taken effect on 5 February 2026. Rather than a general requirement that all personal data be stored domestically, the amended mandate is understood to require that at least one synchronised real-time copy of data be maintained within Bangladesh's borders only for data classified as Critical Information Infrastructure or as restricted or confidential personal data. This narrows what had been reported as a broader localisation obligation under the original Personal Data Protection Ordinance, 2025, to a more targeted category of sensitive and critical data.

This narrowing is reported with reasonable corroboration from a source tracking the ordinance's legislative history, and represents a more commercially workable cross-border transfer posture than a blanket localisation rule would have produced, since data falling outside the Critical Information Infrastructure and restricted/confidential categories is not described as subject to the same in-country copy requirement. No separate adequacy mechanism or cross-border transfer approval regime beyond this localisation carve-out has been identified in the material available.

Cross-Border & Adequacy

Cross-border transfer under the Personal Data Protection Act, 2026 is understood to permit internal and confidential data to be transferred abroad with data-subject consent or for contractual purposes, but only to countries meeting appropriate data-protection standards - an adequacy-style gate on outbound transfers. More significantly, the Personal Data Protection (Amendment) Ordinance, 2026 (Ordinance No. 23 of 2026), made in February 2026, narrowed what had been a broader in-country-storage mandate. Under the amended position, only data categorised as restricted, or data processed by Critical Information Infrastructure, must have at least one synchronised, real-time copy maintained within Bangladesh's borders - a materially narrower localisation requirement than a blanket in-country-storage rule would impose on data generally.

Outlook

The February 2026 narrowing of the localisation mandate is the best-evidenced development in this area and represents a genuine loosening of what had been a broader data-residency requirement, confined now to restricted and critical-infrastructure data. Firms handling data outside those narrowed categories gain a materially freer hand on storage location, while the adequacy-style gate on outbound transfers of internal and confidential data remains a separate and continuing constraint on cross-border flows more broadly.

Cross-Border & Adequacy

Bangladesh's approach to cross-border data transfer control does not, on the evidence available this cycle, take the form of a formal adequacy-decision or standard-contractual-clause regime of the kind seen in GDPR-aligned frameworks. Instead, the National Data Management Authority's reported principal mechanism is a direct intervention power: the Authority may order the immediate suspension or cessation of data transfers to foreign countries or international organisations where its standards are not met. This functions as an after-the-fact control lever rather than a prior-authorisation or whitelisting mechanism, and no adequacy decision involving Bangladesh, in either direction, was found this cycle.

The Personal Data Protection (Amendment) Ordinance 2026 (Ordinance No. 23 of 2026), dated 5 February 2026, is reported to have narrowed what had previously been a broader data-localisation mandate. Under the amended position, only at least one synchronised, real-time copy of data classified as restricted, or data processed by Critical Information Infrastructure as defined under the Cyber Security Ordinance 2025, must now be stored within Bangladesh's borders. This is a loosening rather than a tightening of the localisation requirement relative to the regime as it previously stood, narrowing the category of data subject to mandatory in-country storage.

Taken together, the cross-border regime now rests on two distinct pillars: a narrowed, category-specific localisation requirement applying only to restricted and Critical Information Infrastructure data, and a broader but reactive suspension power that the National Data Management Authority can exercise against any transfer it judges fails to meet its standards, regardless of data category.

Outlook

Whether Bangladesh develops a more structured adequacy or transfer-mechanism framework, of the kind that would give controllers greater ex-ante certainty than the current suspension-power model, is the principal item to watch. Confirmation of the precise scope of the Critical Information Infrastructure definition under the Cyber Security Ordinance 2025, which determines which data remains subject to the narrowed localisation duty, would also sharpen the present account.

Cross-Border & Adequacy

The Personal Data Protection (Amendment) Ordinance, 2026 (5 February 2026, Ordinance No. 23 of 2026) is reported to have materially narrowed Bangladesh's data-localisation requirements. Under amended Section 29(7)(b), the mandatory synchronized real-time local-copy requirement now applies only to restricted personal data and to data processed by Critical Information Infrastructure. General, internal and confidential data held on foreign cloud services are now exempted from the mandatory local-copy obligation that had applied more broadly under the original drafting of the data-protection framework. This represents a material liberalisation relative to the originally-drafted localisation mandate, and is a structural rather than episodic shift in Bangladesh's approach to cross-border data flows.

For transfers for law enforcement or international cooperation purposes, formal agreements remain required as a condition of transfer, a standing requirement that was not altered by the February 2026 amendment. Separately, industry commentary on the earlier Ordinance text noted that cross-border transfers were conditioned on consent or contract-based grounds, with no equivalent provision for transfers based on legitimate interests, a structural feature that narrows the range of lawful bases available for routine cross-border data flows compared with regimes that permit a legitimate-interests transfer basis.

The combined effect of the narrowed localisation requirement and the consent/contract-only transfer-basis structure is that businesses handling general categories of Bangladeshi personal data gain increased flexibility to use foreign cloud infrastructure, while the categories of data subject to heightened localisation (restricted personal data, Critical Information Infrastructure data) remain subject to the stricter synchronized local-copy requirement, and all cross-border transfers remain tied to consent or contractual grounds rather than a broader legitimate-interests basis.

Outlook

The practical scope of "restricted personal data" and "Critical Information Infrastructure data" for purposes of the retained localisation requirement has not been fully detailed in the sourcing available this cycle, and clarification of these category boundaries would sharpen understanding of which data flows remain subject to the stricter local-copy obligation following the February 2026 amendment.

Cross-Border & Adequacy

Data-localisation requirements in Bangladesh have been in flux across three instruments within under a year: the Personal Data Protection Ordinance, 2025; the Personal Data Protection (Amendment) Ordinance, 2026 (Ordinance No. 23 of 2026); and a reported March 2026 revision. Industry commentary from CCIA describes this March 2026 revision as having removed outright data-localisation mandates that had existed under the earlier ordinance framework. However, the final position under the enacted Personal Data Protection Act, 2026 is not confirmed from primary text this cycle, so it remains uncertain whether the localisation relaxation reported in industry commentary was carried through into the permanent Act as passed.

Separately, the Act is reported to include a cross-border data-exchange cooperation provision, referencing bilateral or multilateral mechanisms and recognition of equivalent standards in other jurisdictions. This provision has the shape of an adequacy-style mechanism, but it has not been confirmed as a formal adequacy mechanism in the sense used by other comprehensive regimes; the available commentary describes it only in general cooperative terms rather than as a structured adequacy-assessment process with defined criteria or a list of recognised jurisdictions.

Taken together, this module presents an unusually unsettled picture for a newly-enacted comprehensive regime: the core cross-border rules appear still to be settling even as the Act itself has moved from draft to enactment, and organisations relying on cross-border transfers to or from Bangladesh do not yet have a confirmed, stable rule set to plan against.

Outlook

The central open question is whether the localisation relaxation reported for the March 2026 revision survived into the enacted PDPA 2026, and whether the cross-border cooperation provision will be elaborated into a formal adequacy or transfer-mechanism framework through implementing rules. Primary-text retrieval is needed before either question can move beyond uncertain.

Algorithmic, Biometric & Surveillance Governance

Article 29 of the Personal Data Protection Act, 2026 is reported to empower the government to classify personal data into four tiers: public or open personal data, internal data, confidential data, and restricted data. This classification power sits upstream of several other duties already noted, including the narrowed data-localisation requirement, which attaches specifically to data falling into the restricted or confidential tiers.

Civil-society commentary has proposed narrower-construction safeguards around how broadly the government may exercise this classification power, but these proposals are not confirmed as having been enacted, and the scope of any state-surveillance carve-out tied to the classification scheme has not been resolved to rule level. The practical consequence of the classification power, in particular how it interacts with government access to data nominally held by private controllers, remains an open question pending clearer primary-source confirmation.

Algorithmic, Biometric & Surveillance Governance

Bangladesh is reported, as of mid-2026, to remain without a standalone AI Act; a draft National AI Policy covering 2026-2030 exists but remains non-binding. Against that general-governance gap, a sector-specific carve-out has appeared in the Gambling Prevention Act 2026, which is understood to permit the use of artificial intelligence-based monitoring systems to detect and prevent gambling operations. This is a narrow, sector-specific authorisation for AI-based surveillance tied to gambling enforcement, distinct from any general biometric-identification or broader state-surveillance regime, and it has not been linked in sourcing reached this period to any wider biometric framework.

Outlook

The absence of a general AI statute leaves algorithmic and biometric governance in Bangladesh to proceed, for now, through sector-specific carve-outs of the kind seen in the Gambling Prevention Act rather than through a unified cross-sectoral framework. Whether the non-binding draft National AI Policy is converted into binding legislation, and whether further sector-specific AI-surveillance carve-outs follow the gambling-sector pattern, remain open questions.

Algorithmic, Biometric & Surveillance Governance

The Personal Data Protection Act 2026 is reported to grant data subjects a right to restrict automated decisions made using their personal data, a provision that gives Bangladeshi data subjects at least a baseline mechanism to object to purely automated processing that affects them. This sits within the data-subject-rights package discussed above but carries distinct significance for algorithmic governance specifically, since it is the Act's primary textual hook for addressing automated decision-making.

Beyond that single restriction right, however, the Act is reported not to address artificial intelligence more broadly, and is not understood to provide any guidance on how automated decision-making systems, including agentic AI systems, should be governed, assessed for risk, or made subject to any form of algorithmic impact assessment. This is a notable gap relative to more recently drafted data-protection and AI-adjacent frameworks elsewhere, which increasingly pair a restriction right with accompanying risk-assessment or transparency obligations for the systems themselves.

Section 24 of the Act, discussed above under lawful processing, is also relevant to this module because it functions as a state-surveillance carve-out: the broad exemption from consent and notice duties for crime-fighting, investigations, regulatory and statistical functions, triggerable on national-security, public-order or crime-prevention grounds without an explicit judicial-authorisation requirement, has direct implications for the use of biometric or surveillance technologies by government bodies, insofar as such use could be framed as falling within one of the listed grounds.

Outlook

Whether Bangladesh develops a separate AI-governance instrument or amends the Act to add algorithmic risk-assessment obligations is the principal item to watch, given the currently reported absence of any such framework. The practical scope of the Section 24 surveillance carve-out, and whether any guidance or case law develops around its boundaries, is a second item worth monitoring closely given its potential interaction with biometric and surveillance deployments.

Algorithmic, Biometric & Surveillance Governance

The National Data Management Act, 2026 is reported to mandate a unified identity layer linking core government registers, established under Section 23 and its accompanying Schedule. This identity layer is to be operated by the National Data Management Authority, a body situated within the executive branch and attached to the Prime Minister's Office. Independent civil-society and press commentary has raised concern that no independent judicial check over this identity-layer function has been identified, meaning that the design, operation and expansion of a unified government identity system sits under executive control without an apparent external oversight mechanism specific to that function.

This development should be read as a structural governance feature of the broader National Data Management Act rather than an isolated incident: a unified identity layer linking government registers has implications that extend beyond conventional data-protection compliance into questions of surveillance capacity and state access to linked personal data across multiple registers simultaneously. The absence of an identified independent judicial check is the central point of concern raised in available commentary, rather than any specific documented instance of misuse.

Outlook

Whether an independent oversight mechanism is introduced for the unified identity layer, whether through judicial review provisions, a separate oversight body, or parliamentary scrutiny mechanisms, remains an open question that will materially affect how this module's risk profile develops. No such mechanism has been confirmed in sourcing available this cycle.

Algorithmic, Biometric & Surveillance Governance

The Personal Data Protection Act, 2026 confers a right to limit automated decisions based on personal data, conferred at a headline level without confirmed operational detail. This right sits in evident tension with other provisions of the same Act: the government retains the power to direct the National Data Governance Authority in the interests of national security or public order, and the Authority is understood to be legally bound to comply with such direction. The practical effect is that an individual right against automated decision-making exists on the face of the statute, but the body charged with enforcing that right can itself be directed by the government on broad grounds, which limits how much independent assurance the right currently carries.

No biometric-specific statutory regime exists in Bangladesh distinct from the PDPA's general rules. Reported commentary on data-exchange and digital-ID preparation describes ongoing civil-society concern about National ID and digital-ID data-sharing arrangements, though this is reported as a concern rather than as a confirmed legal or enforcement development. The absence of a biometric-specific regime means that biometric data processing — a category typically treated with heightened sensitivity in comprehensive regimes — currently falls under the same general consent-and-exemption architecture as other personal data in Bangladesh, rather than under dedicated special-category rules.

The combination of broad national-security carve-outs and the absence of a biometric-specific regime is the structurally significant finding for this module: surveillance-adjacent processing, including NID and digital-ID data flows, is governed by the same general-purpose statute that grants the State wide exemption grounds, rather than by a dedicated framework with its own safeguards.

Outlook

Whether the civil-society concerns around NID and digital-ID data-sharing develop into a specific regulatory response, and whether the Authority issues any guidance narrowing the national-security exemption as it applies to automated-decision and surveillance-adjacent processing, are the questions to watch. Given the Authority's own structural position under the Prime Minister's Office, independent elaboration of these safeguards cannot currently be assumed.

Enforcement & Redress

The newly established Data Protection Authority is reported to have power to sanction private-sector entities, including banks and technology companies, for data-protection violations. At the same time, academic and journalistic commentary converges on a structural limitation: because the Authority is seated within the executive branch, it reportedly lacks comparable reach to sanction government ministries that misuse citizen data. This asymmetry between private-sector and government accountability is a well-corroborated feature of the institutional design, drawn from more than one independent source, and stands as the central enforcement-and-redress issue in Bangladesh's new regime.

The practical effect is an enforcement posture that is, at present, considerably stronger against commercial data handlers than against the state itself. For individuals seeking redress against misuse of their data by a government body, as distinct from a private company, the available record does not establish an equivalent pathway through the Authority.

Outlook

Whether the Authority's independence and powers vis-à-vis government bodies are strengthened, whether through amendment or through the Authority's own developing practice, is the main open question for Bangladesh's enforcement regime going forward. The broader move from no comprehensive data-protection regime to an enacted statute and regulator within roughly five months marks a significant regulatory tightening overall, even as this specific accountability gap remains unresolved.

Enforcement & Redress

The clearest enforcement-side development this period is the Personal Data Protection (Amendment) Ordinance, 2026 (Ordinance No. 23 of 2026), made in February 2026, which replaced the threat of imprisonment for managing directors under section 48 of the original Ordinance, for violations of data-subject rights, with monetary fines only. This is a confirmed shift in the personal-liability exposure of corporate officers under the regime, moving the consequence for such violations from a criminal register to a financial one, although the specific fine amounts or tiers introduced have not been located in sourcing reached this period, and no enforcement decision applying the revised position has yet come to light.

Outlook

Decriminalising managing-director liability while apparently retaining monetary penalties signals a regime still finding its enforcement footing - substantive powers exist on paper, including those reported for the NDGA, but no track record of applied penalties or published enforcement decisions is yet available to show how those powers operate in practice.

Enforcement & Redress

Bangladesh's enforcement and redress framework under the Personal Data Protection Act 2026 combines a reported fine regime with a notable limitation on regulator independence. Administrative fines of up to 2-5% of annual turnover in Bangladesh are reported to apply for violations of data-subject rights under Section 32, though this figure rests on a single Tier-3 secondary source and its pinpoint has not been confirmed against the gazette. Separately, administrative fines of up to BDT 25 lakh are reported for security failures under Section 33, discussed above under controller and processor duties.

On criminal exposure, the Personal Data Protection (Amendment) Ordinance 2026 is reported to have replaced what had previously been exposure to imprisonment or a fine, or both, for managing directors under the former Section 48, substituting a fine-only penalty. However, unauthorised processing or disclosure of personal data under Section 36 is reported to still carry a potential term of imprisonment of up to five years as an underlying offence, meaning criminal exposure has not been removed from the regime altogether, only narrowed for the specific managing-director liability previously found in Section 48.

A structurally significant limitation on the National Data Management Authority's independence is reported under Section 49, which is understood to allow the government to direct the Authority on national-security or public-order grounds, with such direction binding on the Authority. Domestic commentary has flagged this as a material departure from the kind of institutional independence associated with GDPR-aligned regulators, since a government-directed regulator may face constraints on pursuing enforcement action that touches government interests or government-exempted processing under Section 24.

Illustrating a practical enforcement gap under the new regime, an investigation reported in June 2026 found the final voter list for Bangladesh's thirteenth parliamentary election being sold openly on a social media platform for prices ranging from 30 to 250 taka, across more than 500 posts attributable to at least fifteen accounts. This incident, reported before the fuller Sections 31-35 complaints and penalty machinery is expected to activate around May 2027, illustrates the practical gap between the statutory fine regime now on the books and the Authority's current operational capacity to act against large-scale unauthorised data sales.

Outlook

The activation of the fuller Sections 31-35 complaints and administrative-penalty machinery, expected on or around 13 May 2027, is the key date to watch, since it will determine whether incidents of the kind illustrated by the voter-list sale can be addressed through the Authority's formal enforcement powers rather than relying on press investigation alone. Confirmation of the precise Section 32 fine percentage against the gazette, and any indication of how Section 49's government-direction power is or is not exercised in practice, are the two further items most worth tracking.

Enforcement & Redress

The National Data Management Authority holds confirmed enforcement powers including the ability to issue formal warnings, impose administrative fines, and order the immediate suspension or cessation of cross-border data transfers where compliance standards are not met. These powers position the Authority as an active supervisory body with direct operational levers over data flows, rather than a purely advisory or registration-based regulator.

A notable structural development is reported in connection with the February 2026 amendment: the earlier approach of criminal imprisonment of managing directors for certain violations is understood to have been replaced with an administrative-penalty approach instead, shifting the primary enforcement consequence away from individual criminal liability and toward corporate administrative sanctions. This is consistent with international regulatory trends away from criminalising individual corporate officers for data-protection failings in favour of proportionate administrative fines, though the shift also reduces the personal-liability deterrent that a criminal-imprisonment provision would otherwise create.

Separately, administrative penalties imposed under the Act are reported to remain appealable to the Tribunal constituted under Section 68 of the Information and Communication Technology Act, 2006, within thirty days, providing an established appellate pathway for contesting Authority decisions rather than requiring a new tribunal structure to be built from scratch.

Outlook

The practical operation of the Authority's enforcement powers, including the scale of administrative fines actually imposed and the frequency of cross-border transfer suspension orders, has not yet been documented and will be a key area to track as the framework moves from statutory design into active supervisory practice.

Enforcement & Redress

The enforcement architecture for Bangladesh's data-protection regime shifted materially this cycle. The Personal Data Protection (Amendment) Ordinance, 2026 replaced criminal liability, including imprisonment, for managing directors under section 48 of the prior ordinance framework with monetary fines only, effective 5 February 2026. This is a significant liberalisation of the personal-liability exposure facing senior individuals at obliged organisations, moving the regime away from a criminal-sanction model toward an administrative-penalty model, though the specific fine-tier amounts under the amended provision are not confirmed from primary text this cycle.

This enforcement shift predates the enactment of the permanent Personal Data Protection Act, 2026 itself, having taken effect under the amendment ordinance in February 2026, several months before the Act's reported April 2026 passage. Whether the enacted Act carries forward the monetary-fines-only approach, or whether it reintroduces or modifies criminal liability in some other form, is not confirmed from the secondary sources available this cycle.

Separately, academic commentary has flagged the institutional capacity of the National Data Governance Authority as an open implementation risk. Whether the Authority is operationally functioning as of October 2026 — meaning whether it has staff, budget, published guidance, or a functioning complaints process — could not be confirmed this cycle. This is a material gap: an enforcement regime is only as effective as the body empowered to enforce it, and the Authority's practical capacity remains an open question even as the underlying statute has been enacted and the liability structure has shifted toward fines.

Outlook

Confirmation of the Authority's operational status, and of the specific fine-tier amounts now applicable under the amended enforcement provisions, are the clearest open items for this module. The gap between a materially changed legal liability structure and an unconfirmed operational enforcement capacity is the central watch item going into the next cycle.